In Oracle Adaptive Access Manager, rule logs are captured during the execution of various policies and rules at the different checkpoints (such as Pre-Authentication, Post-Authentication, and others).
Oracle Adaptive Access Manager supports two rule logging options:
Detailed rule logging - Detailed rule logging captures the time taken at each rule level.
Fingerprint rule logging - Fingerprint rule logging captures only the time taken at the policy level. Fingerprint rule logging reduces logging overhead in the database; thereby improving performance. In 11g, rule log fingerprinting is enabled by default.
Time taken values are performance statistics and the length of time that the rule or policy took to execute.
Detailed rule logging captures the time taken at each rule level.
The steps to enable detailed rule logging are:
In the Navigation tree, double-click Properties under Environment.
Enter vcrypt.tracker.rules.trace.policySet in the Name field and click Search.
In the Results table, select vcrypt.tracker.rules.trace.policySet.
In the Details vcrypt.tracker.rules.trace.policySet section, enter true in the Value field.
A confirmation dialog is displayed.
Click OK to dismiss the dialog.
Specify checkpoint to log rules.
The steps to specify the checkpoint in which to log are:
In the Navigation tree, double-click Properties under Environment.
Click the New Property button or the Create new property icon.
Enter vcrypt.tracker.rules.trace.policySet.<checkpoint string value> in the Name field.
Enter true in the Value field and click Create.
For detailed rule logging, you can configure a threshold time value, "x," so that logging is performed only if the time taken for the rule is greater than the threshold value.
To modify the threshold time after which the rule logging should begin, follow these steps:
In the Navigation tree, double-click Properties under Environment.
Enter vcrypt.tracker.rulelog.detailed.minMillis in the Name field and click Search.
In the Results table, select vcrypt.tracker.rulelog.detailed.minMillis.
In the Details vcrypt.tracker.rulelog.detailed.minMillis section, edit the value in the Value field.
Click Save.
A confirmation dialog is displayed.
Click OK to dismiss the dialog.
If a policy takes more than "x" in milliseconds specified, Oracle Adaptive Access Manager starts the detailed rule logging.
In the next sections, the Post-Authentication checkpoint is used to illustrate rule logging.
In detailed rule logging, the flow is as follows:
The Rules Engine checks for a vcrypt.tracker.rules.trace.policySet.<checkpoint string value> configuration.
For example, vcrypt.tracker.rules.trace.policySet.postauth.
If there is no configuration for vcrypt.tracker.rules.trace.policySet.postauth, the Rules Engine checks the value of vcrypt.tracker.rules.trace.policySet.
By default, the value for vcrypt.tracker.rules.trace.policySet is set to "true".
The values of the two properties determine whether rule logging is enabled for a given checkpoint.
Refer to Section I.1.5, "Value Combinations" for details on value combinations that specify rule logging.
If the logging configuration is explicitly set at the given checkpoint, the Rules Engine uses that value; otherwise, it uses the value of vcrypt.tracker.rules.trace.policySet.
The following matrix shows an example of how value combinations control logging during a specified checkpoint.
The Post-Authentication checkpoint is used in this example.
| value of vcrypt.tracker.rules.trace.policySet.postauth | value of vcrypt.tracker.rules.trace.policySet | Will Rule logging be enabled for the postauth checkpoint? |
|---|---|---|
| true | false | yes |
| true | true | yes |
| true | not set | yes |
| false | false | no |
| false | true | no |
| false | not set | no |
| not set | false | no |
| not set | true | yes |
| not set | not set | yes |
The properties to control the logging of rules that did not trigger are:
vcrypt.tracker.rules.trace.notTriggered=[true|false] vcrypt.tracker.rules.trace.notTriggered.logMillis=[millis]
The value of vcrypt.tracker.rules.trace.notTriggered adds rules to log. If set to "true," rules that are not triggered are logged along with the triggered rules.
The value of vcrypt.tracker.rules.trace.notTriggered.logMillis narrows down which rules are logged.
If the rule execution for non-triggered rules exceeds the value of vcrypt.tracker.rules.trace.notTriggered.logMillis, only then will the Rules Engine log the non-triggered Rules.
The following table shows the property values that control what non-triggered rules are logged.
| vcrypt.tracker.rules.trace.notTriggered | vcrypt.tracker.rules.trace.notTriggered.logMillis | Result |
|---|---|---|
| true | n | Logs the non-triggered Rules that took more than "n". If "n" is set to a negative value, all Rules are logged |
| false | n | None of the non-triggered Rules will be logged |
To enable or disable fingerprint rule logging, modify the following property
vcrypt.tracker.rulelog.fingerprint.enabled=true
Properties can be set for
Running either fingerprint or detailed logging
Running both fingerprint and detailed logging and when
Fingerprint logging threshold
Specify Whether Fingerprint or Detailed Logging Runs
To set a property to determine if fingerprint or detailed logging runs, set
vcrypt.tracker.rulelog.exectime.maxlimit
If the value is exceeded, detailed logging is performed.
Specify to Include Other Limits
To include all specified properties in determining the use of both, set
vcrypt.tracker.rulelog.exectime.maxlimit=-1
To specify to perform logging with both logging mechanisms (detailed and fingerprint), set
vcrypt.tracker.rulelog.logBoth
to true. The value overrides vcrypt.tracker.rulelog.exectime.maxlimit.
Configuring Fingerprint Logging Threshold Time
To modify the threshold time after which fingerprint rule logging should be used, set the following property in milliseconds:
vcrypt.tracker.rulelog.exectime.maxlimit=